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In this paper we establish a deep connection between the 3 qubit one-to-two phase-covariant 
quantum cloning network of Fuchs et al. [C. Fuchs, N. Gisin, R.B. Griffiths, C.S. Niu, and A. 
Peres, Phys. Rev. A 56 n°4, 1163 (1997)], and its economic 2 qubit counterpart due to Niu and 
Griffiths [Phys. Rev. A 60 n°4, 2764 (1999)]. A general, necessary and sufficient criterion is derived 
in order to characterize the reducibility of 3 qubit doners to 2 qubit doners. When this criterion 
is fulfilled, economic cloning is possible. We show that the optimal isotropic or universal 3 qubit 
fT^ , cloning machine is not reducible to a 2 qubit doner. 
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Quantum Information emerged from the fruitful cross-fertilization of quantum mechanics and information technol- 
ogy. In the last decade, particularly promising applications such as quantum cryptography, quantum cloning, quantum 
0^ • teleportation, quantum games and quantum computers were implemented experimentally, with more or less succes 
; [l, 2, 3, 4, 5j. Although it is not certain that these progresses will lead to a practical quantum computer , because 
of the difficulties inherent to decoherence, quantum cryptography is already a grown up, user friendly and efficient 
technology Traditionally, it is implemented with two-level quantum systems, known as qubits. The inviolability 

', of the quantum key distribution protocols such as the BB84 protocol Q is guaranteed by the no- cloning theorem 

■ 0] that states that perfect copying (cloning) of a set of input states that contains at least two non-orthogonal 
0^ \ states is impossible. It is however possible to realize approximate quantum cloning, a concept that was introduced in 

. a seminal paper of Buzek and Hillery where a universal (or state-independent) and symmetric one-to-two cloning 

■ transformation was introduced for qubits. Here we are rather interested in state-dependent, symmetric or asy mmetric 
O , one-to-two quantum cloning, in particular in the so-called phase-covariant qubit t^-ansformation ^, il UJI that op- 

timally copies (with the same fidehty) all the pure states of the form ^(|0)^ + e'-^ll)^) (where (j) S [0, 2tt] while |0) " 

and represent up and down spin states along a conventional direction Z). Such "equatorial" states are located 
on the intersection of the XY plane with the Bloch sphere. It is important in the context of quantum cryptography 
to study the performances of such doners because they condition the security of quantum cryptographic protocols. 
For instance the optimal phase-covariant doner is presently believed to provide the most dangerous eavesdropping 
strategy for the BB84 quantum cryptographic protocol JJ. This justifies the interest of implementing experimentally 
^ ' the qubit one-to-two phase covariant doners that were theoretically proposed in the past. The first theoretic proposal, 
• ^ that we shall from now on denote the FGGNP proposal, required the use of 3 aubits(121]. two in addition to the one 
carrying the original signal. Unfortunately, recent NMR experiments that were realized in order to implement the 
H \ (3 qubit) universal qubit doner Q showed that a substantial loss occured, due to inhomogeneities of the magnetic 
. . 1 field and decoherence. It was difficult during that experiment to avoid such effects because the corresponding cloning 
network contained no less than ten single qubit gates and five 2 qubit gates. Moreover, it required to control with 
enough precision the two-by-two entanglement between three qubits which is not a simple task at all. A quick anal- 
ysis of the results of |l2j| shows that an experimental implementation of their proposal for phase-covariant cloning 
would certainly face the same problems. Fortunately, in the case of phase-covariant cloning, there exists in theory a 
simplified, "cheap" or "economic" 2 qubit network due to Niu and Griffiths T^, that we shall from now on denote the 
NG proposal, in which no external ancilla is required and that exhibits the same cloning properties as the FGGNP 
proposal. This proposal is quite simpler to implement experimentally, it requires only two single qubit gates and one 
2 qubit gate, and it requires to control the entanglement of a pair of qubits only. It is thus likely to be quite less noisy 
than its 3 qubit counterpart. The goal of the present paper is to elucidate the connections that exist between 2 and 3 
qubit doners. It can be seen as a first step towards a study of the possibility to replace 3 quiVit doners by (economic) 
2 quA'^it doners, a problem that presents a real interest in connection with the security of quantum cryptographic 
protocols. 

In the second section, we introduce some useful formal tools and establish a deep relation between the FGGNP 
transformation and the NG transformation, in the sense that we prove that the FGGNP transformation is equivalent 
to a symmetrised version of the NG transformation. In the third section, we derive a general theorem that defines 
precisely under which conditions a 3 qubit doner is reducible to a 2 qubit doner. It allows us to prove the non-existence 
of such a relation in the case of universal cloning. 
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A summary of our results, conclusions, and a brief discussion of some open problems are presented in the last 
section. 



II. 3 QUBIT AND 2 QUBIT PHASE-COVARIANT CLONERS, AND CONNECTIONS BETWEEN 

THEM. 

A. (A strictly covariant generalisation of) Cerf's formalism for 3 qubit phase-covariant doners 

Before we introduce Cerf's formalism for cloning machines it is useful to recall the properties of the so-called Bell 
states. The four Bell states are defined as follows: 



KJi.2 - ^^(-)'--"|fc>f|fc + m)f (1) 



where m, n e {0, 1}. 
Consequently: 

\Blo)i,2 - ^{|0)f |0>f + |l>f |l)f }, iSo^i) = ^{|0)f |0)f - |l)f |l)f } (2) 

\Bl,) = ^{|0>f |l>f + |l>f |0>f }, \Bl,) = ^{|0)f |l>f - |l>f |0)f } (3) 

where |0(1))^2) represents a spin up (down) state of the qubit system 1 (2) along a conventional direction (here the 
Z direction). They are maximally entangled states and form an orthonormal basis of the 4-dimensional Hilbert space 
spanned by the qubit states 1 and 2. 

Let us now consider the following situation: Alice sends to Bob qubits that are either spin up or spin down along 
Z with 50-50 probability. Note that this is equivalent to a situation during which Alice and Bob share the maximally 
entangled state \Bo^o)a,b, while Alice measures the spin of her qubit along Z. N. Cerf proposed in Refs. (TBI, a 
general characterization of asymmetric and state-dependent 1 — > 2 cloning transformations for 2-level systems which 
is, roughly speaking, summarised as follows. Eve copies the state |-Bo,o)a b by replacing it by the cloning state, which 
is assumed to be a 4 qubit state (one qubit for Alice, one for Bob, one for Eve and one ancilla). We shall from now 
on denote it ^ _b m where the indices are representative of the reference qubit possessed by Alice (A), of the two 
output clones {B for Bob and E for Eve), and of the (2-dimensional) ancilla or cloning machine (A/). According to 
Cerf's ansatz, the cloning state is biorthogonal in the Bell bases, which imposes that 

1 

\^)a,B,E,M — ^ ajn,n\Bra,ri)\^B\Bm.,n)^.M (4) 
m,n— 

where a^.n is a (normalised) 2x2 matrix. The specification of the amplitudes a^.n defines the cloning transformation. 
Remark that such a state can be obtained by letting work on the initial state |-Bo,o)a bI^o,o)1 m ^ unitary transfor- 
mation of the type \a ® Ube ^ 1m that affects neither Alice's qubit, nor the ancilla (although the preparation of the 
initial state requires that Eve entangles the clone and the ancilla). 

The deep reason therefore is that Bell states \Bm,n)i^2 can be generated from an initial state prepared along 
\Bo,o)i.2 local transformations. For instance, we have li (8) cr^|i?o,o)f 2 = l^i,o)f,2: li ^ '''2' 1-^0,0)^2 = *I-Si,i)f,2j 
li (g) erf |i3o,o)f,2 = 1-^0, i)f 2 where the cr's are the Pauli matrices. In virtue of this property, it is not absolutely 
necessary that Alice and Bob share a maximally entangled state to begin with: we can as well consider the situation 
in which Alice sends directly a qubit to Bob. Nevertheless, it is convenient to consider directly the cloning state in a 4 
qubit space because as we shall see now there exists a covariant generalization of Cerf's formalism in which a "mirror" 
relation exists between Alice's qubit and the cloning machine at one side, and between Bob's clone and Eve's clone 
at the other side. 

Before describing this generalization, it is useful to introduce and to motivate the concept of strict covariance. In 
order to do so, let us consider the Z' basis defined as follows: |0)^ ~ |0)^j \^)^ = Obviously the following 

identities are satisfied: |So,o)f2 = 1^0,1)^2. 1-^0,1)5 = 1^0,0)^2. \Bifi)f'2 = «l^i,o)f 2: and |Bi,i)f'2 = i|Bi,i)f,2- Be- 
cause of this, the amplitudes of the cloning state l^*)^ b e m — t!=o (^m,n\Bm,n)A B\^m,n)E m are not necessarily 
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the same in the primed basis. For instance (Olf (0||' (l|f; 1*)^ = (-)(0|i(l||(0||(l|f,|vl/)| We 

shall say that \'^)^ b e m '^'^^ strictly covariant when we pass from the Z to the Z' basis. Nevertheless, all the 

expectation values, of the type {ijkl\^g ^ m\^)a b e b e MVj^^)'jiB i; Af which are the diagonal coefficients 

of the density matrix considered in the product basis assigned to the local detectors labelled by A,B,E,M, are the 
same in both bases. As these are the single quantities that are of physical interest in the present context, we can say 
that although the state \'^)abem ^'-'^ strictly covariant when we pass from the Z to the Z' basis it is covariant 
FAPP. 

Now, let us recall that the theory of cloning machines was developed for estimating the safety of quantum cryp- 
tographic protocols. In such protocols, the information is encoded in at least two non-commuting bases, which 
guarantees that a perfect cloning process is impossible, in virtue of the no-cloning theorem. Because of this limita- 
tion, the best that Eve can do for eavesdropping the signal is approximate cloning, and optimal approximate cloning 
corresponds, as far as we know, to the most dangerous (unperfect) eavesdropping strategy that Eve is able to resort 
to. It is usually assumed, conservatively, that Eve has perfect technology at her disposal (perfect transmission lines, 
perfect quantum devices and so on), and that she dissimulates the presence of her unperfect doner under the noise 
that would be otherwise attributed to an unperfect transmission lines. Usually, transmission lines are isotropic, which 
implies that the error rate or transmission noise is the same in all encryption bases so that the doners must fulfill a 
fundamental constraint: they must exhibit the same fidelities in all encryption bases (the fidelity F is defined for a 
dichotomic signal as follows: F—l-e where e is the error rate). In the following, we shall be interested in doners that 
(i) satisfy the Cerf ansatz, and (ii) that are strictly covariant when we pass from one encryption basis to the other. 
This constraint is certainly exagerated because in principle FAPP covariance (even less, FAPP covariance in Alice and 
Bob's encryption/decryption bases only) is a sufficient constraint in order that the doner provides an unthwartable 
eavesdropping strategy. Nevertheless, it can be checked that all the interesting doners in the litterature, without 
exception, satisfy the conditions (i) and (ii). It is not our goal in the present paper to motivate why these conditions 
seem to be so natural in the study of cloning machines (see for instance the fourth section of Ref.[l3| for a tentative 
explanation of the generality of Cerf 's ansatz.). We shall show in the rest of this section that once they are accepted, 
it is very easy to establish a deep connection between FGGNP's 3 qubit phase-covariant doner and NG's 2 qubit 
phase covariant doner. 

Let us come back to the Z-Z' transformation previously introduced. As we noted already, the first Bell state |i?o,o) 
is not invariant: |So.i)f 2 — l^o,o)f2 7^ l^o,o)f 2 = l^o,i)f 2- There is another way to show this dissymetry between 
the Z and the Z' bases: formally, if Alice and Bob share the maximally entangled state |i3o,o)ABi ^^lat Alice 
wants to transmit to Bob states that are encrypted in the primed basis, she must encode her own qubits into the 
conjugate basis Z'* defined as follows: |0*)^' = |0)^, = Indeed, it is easy to check the identity 

\Bo,o)Ib - ^{|o)i|o)i + |i)i|i)i} = -^{|o*)I'|o)i + |r)^'|i)i} (s) 

This identity is the special case of a very general property: let us consider an arbitrary basis (|'0o)j IV'i)) that we 
denote the ?/' basis (with — Uij). If Alice and Bob share the joint state |-Bo,o)ab ^^'^ that Alice wishes to 

encode the signal in the ip basis, she must project her component of |i?o,o);A b ^^^'^ (conjugate) ip* basis defined 
as follows: (ilipj) = U*j. This property is obvious if we note that, in virtue of the unitarity of Uij, 

1 1 1 

\Bo,o)1b = -/|{|0)I|0)i + |l)I|l)i} = -7^ \^!)Am\k)A ® \i^n.)B{i^.r\k)B 

k,l,7n—0 

1 1 1 1 1 1 



(6) 



It would be nice to modify slightly Cerf's ansatz in order that this basic invariance property is respected. As it 
was shown by one of us 17, 18, 19], it is possible to achieve this goal thanks to a redefinition of Bell states. These 
generalized Bell states can be shown to obey the following definition [TtI IT^ : 



Now, Eve's clone (labelled by E) is assumed to "mirror" Bob's qubit, and as it is shown in the formalism is 
simplified if we consider that the ancilla (M) "mirrors" Alice's qubit, which motivates the following definition: 



4 



\Btn')EM = ;^EU(-)'-"IV'^c)ij|V':+™)M 

Note that when the if) basis is real, we recover the usual definition: 

Accordingly, we shall postulate in the following the (modified) Cerf ansatz: the cloning state is assumed to take 
the following form: 



I*) 



A,B,E.M 



E ' 

m,n— 1 



\B1 



)A,B\Bm.n')E,M 



(8) 



On the basis of these definitions, it is natural to define strict covariance as follows: 
Definition: 

The (generalised) Cerf doner is said to be strictly covariant in the ■0 basis and in the ip basis if and only if 

N-l _ N~l 

\'^)a,B,E,M = E '^"i-^^l^ti' ,n) A,B\Bti,n') E,M = \'^)a,B,E,M = E ^"^-^^l^ti' ,n) A,B\Bti,n') E,M (9) 
m,n— 1 m,n— 1 

In the following theorem is shown: 
Theorem: 

The (generalised) Cerf doner is strictly covariant in the basis and in the ip basis if and only if whenever 

A,B{Bti' ^n\Bta" ,n') A,B ^ then = ,n' ■ 

This theorem provides an operational approach in order to build strictly covariant (generalised) Cerf states: it is 
sufficient to compute the in-products between the generalised Bell states evaluated in the different bases; whenever this 
in-product differs from zero, the corresponding elements of the am,n matrix that defines the cloning transformation 
are equal. 

Note that according to the idcntity|Bl for any pair of bases {ip, ■0}, a,b{Bq', ol^m' n'-')A,B — Sm',oSn',o so that ao,o 
is a free and independent parameter for all cloning machines. 



B. 3 qubit phase-covariant doner (FGGNP doner). 

We shall now apply these results in order to derive the 3 qubit phase-covariant doner. This doner is aimed at 
providing to Eve a strategy for eavesdropping the signal sent by Alice to Bob during the completion of the BB84 
protocol. During this protocol. Eve encrypts Bob's signal (a fresh cryptographic key) either into a state of the X 
basis, or into a state of the Y basis. The 3 qubit phase-covariant doner is thus necessarily covariant in the X basis 
and in the Y basis. We fix the phases of the X and Y basis states as follows: 

1+)^ = i=(|0>^ + |1>^), 1-)^ = i=(|0)^ - (10) 
1+)^ = i=(|0)^ + \-r = -^{\0f - (11) 



Henceforth, it is easy to show the following equalities: 

I I *\X _ \ , \X I *\X _ I \X 



\Y _ \ \Y I , *\Y _ \ , \Y 



and also 



(12) 
(13) 



10)^ = ^(1+)^ + 1-)^), \lf = (1+)^ - 1-)^) (15) 
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From now on we shall omit to write the conjugation marks (*) when we work in the Z basis or in the X basis 
because, as all the states of those bases have real amplitudes relatively to the reference basis states {Z). In order 
to improve the clarity, we shall also always use the notations + and - for labelling the spin up and down states on 
the equator, and reserve the notations and 1 for the spins polarized along the Z direction because this axis plays a 
special role in the whole treatment. One can establish the following equalities by direct computation: 



\^'i,\)A,B = \Bi^o)a,b = \BY,^o)a,b = \BY^o:)a,b 
\BI„)a.b = \B^a)a^b - AbI^,)a.b = H) ketBl,,^^^ 

\BI,)a^b = -\BI^)am = (-*)|i?o''M>A,B = ^\BlA^)AM (17) 



In virtue of the foremcntioned theorem, the state l^*)^ b e m '^^ strictly covariant in the X and the Y bases if and 
only if ai.o = ai,i. In the following, we shall parametrise the matrix am.n of the phase-covariant doner as follows: 
ao,o = v,ao,i = y,ai,o = aia = x. 

Then, in virtue of Eq. the cloning state of the phase-covariant doner obeys the following equation: 

\WX:b^em = v\bI^)aMbI^)em + v\bI^)a.b\bI^)em + x{\bI^)a,b\bI^)em + \bI^)aAbIi)em) (18) 

It is shown in [TtI I that the information gained by Eve is optimal when the phases of the amplitudes am^n Biie all 
the same. Physically, this condition can be shown to ensure that constructive interferences occur in certain detectors 
of Eve, and destructive interference in others, in such a way that Eve maximizes her information over Alice's key. 
Consistently, we shall thus systematically assume in what follows that the matrix {am,n) is a real matrix, with real 
positive coefficients. Normalisation of the phase-covariant doner imposes that 2x'^ +y'^ =1 . 

We can always define an "equatorial" basis that makes an angle with the X basis on the Bloch sphere through 
the expression l-t-)"^ = + e*'^|l)^), \-)'^ = ^(|0)^ - e''^|l)^). By a straightforward computation, it is easy 

to check that the following relations are valid: 

\bI^)am = \Bt,o)AM = l<o*>A,B, \bI^)a,b = \Bt.^o)AM = \bU-^)am, (19) 
\B^fl)A,B = cos(l)\B'l^, j) A,B + isin(l)\Bf,^^)A,B, \bIj)a,b = {-)cos<j)\Bf, -^^}a,b - isin<j)\B^,j^)A,B (20) 

On the basis of these relations and on their complex conjugates, it is easy to establish the strict covariance of the 
doner that satisfies oi^o = on the whole equator. This justifies the name "phase-covariant" or "equatorial" doner 
sometimes met in the litter ature. 

It is worth noting that, although in the seminal paper of FGGNP jl^] the generalized Bell states did not play 
any special role, the phase-covariant doner that they proposed can be shown to be equivalent to the phase-covariant 
doner derived in this section. Therefore, in the rest of the paper we shall systematically refer to the phase-covariant 
doner as the 3 qubit FGGNP doner: from now on, we shall denote the phase-covariant state |vE')™'^ e m defined in 
Eq. (|18|l as \'^)a'Wem ^^'^ consider that they are equivalent, although this identification was made some years after 
the publication of FGGNP's paper. 

Actually, if we consider a doner that clones equally well the Z and the X bases, then the constraint is ai^Q = ao,i, 
and the doner that satisfies this constraint is strictly covariant on the meridian that passes through the poles and 
the X basis states on the Bloch sphere (the big circle constituted by the intersection of the XZ plane and the Bloch 
sphere). We could say that it is a "Greenwich-covariant" doner. Moreover, as all the states on this meridian are 
purely real, the generalized Cerf formalism reduces to the Cerf formalism in this case. The "Greenwich-covariant" 
and the phase-covariant doner obviously exhibit similar properties. This explains why the equivalence between the 
Greenwich-covariant doner a la Cerf and the phase-covariant FGGNP doner was already established by N. Gerf in 
the past (see for instance the appendix of reference [20l|'). 



2 qubit phase-covariant doner (NG doner), and connections with the 3 qubit phase-covariant doner 

(FGGNP doner). 



As before, let us consider that Alice sends a fresh cryptographic key according to the BB84 protocol, which means 

X \_\x 



that she encrypts the signal along a state b chosen at random among one of the four following states: \+)'^ ' 



)l or 
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The NG copying machine works as follows: Eve lets work on the initial state |V'')s|0)f a unitary transformation 
of the type Ube that is conceived in such a way that Ube\0)b\^)e ~ |0)i|0)f ^^^^ t/B£;|l)f |0)f = cosa |i>ilo)| + 
sma|0)i|l)|. 

Remark that no ancilla (A/) is required. 

In order to implement BB84 protocol, Alice and Bob could as well share the maximally entangled state |i?o,o)A,B, 
while Alice would measure the spin of her qubit at random cither along X or along Y . Then, the NG proposal can 
be formulated as follows: Eve copies the state I-Bq.o)! b ^'Y replacing it by the cloning state, which is assumed to be 
a 3-qubit state (one qubit for Alice, one for Bob, one for Eve and no ancilla). We shall from now on denote this state 

\^/A,B,E- 

\'^)a%,e - ^(|0)iC/Bi;|0)i|0)| + |1>I;7bb|1)||0)|) = -L(|000)lBiJ + cosa\UO)^BE + s^na\101)^BE) (21) 
By direct computation we obtain the following expressions for the NG cloning state \'^)a'b e the X basis: 

l^>Z^,B = K(I+>A + 1-)^ )(l+>f + )(l+>f + )+ 

cosa{\+)^ - |-)I)(|+)f - )(|+)| + h)f )+ 
+s^na{\+)i - |-)i)(|+)i + |-):i)(|+)i - )} 
In the Y basis, we get: 

= m+*)A + i-*>^)(i+>^ + i->^)(i+>^ + 

+s^nam+*)^ |-*)X)H)(I+)^ + Hi)}- 

This proves the strict covariance of the NG cloning state in the X and Y bases. It is legitimate to investigate 
whether a connection could exist between the 2 qubit NG cloning state defined in Eq. (|21|l and the 3 qubit FGGNP 
cloning state defined in Eq. (|18|l . Many differences are manifest between this cloning state and the NG state: as we 
noted from the beginning, the FGGNP is a 3 qubit state (actually three + 1 if we also take account of Alice's qubit) 
while the NG state is a 2 qubit state (actually two + 1), but we have also that the FGGNP cloning state is symmetric 
under the spin flip along Z (which exchanges |0)^ and or under the spin flips along X or Y, which is not true for 
the FGGNP cloning state. Actually, this property is a very general property of the Bell states that can be generalised 
to arbitrary dimensions 17, 19] . 

Another difference is that, according to Eq. (|21|1 the NG states form a family of states that are parametrized by 
one parameter only (a), while, taking account of the normalisation, two parameters are necessary for specifying the 
FGGNP state deflned in Eq. ((THJ. 

Nevertheless, the optimal state derived in and exhibits the same properties: the fidelity is then the 
same for Alice and Bob's clones and is equal to ^ + This corresponds to the parameters choices a = j, 

« = i + 7I'y = 5-7I'^^^^^7I- ^ 

In general (this is for instance the case with the universal cloning machine [21|), if Eve suppresses the ancilla, she 

loses some useful and relevant information, but this is not true in the present (optimal) case as is also shown in |2lj |. 

We shall now show that a subclass of the set of FGGNP states, for which the ancilla can be dropped without 

losing information, reduces to a one-parameter class of states that "looks like" the NG state after elimination of the 

ancilla (the qubit M). In order to do so, let us for instance consider that after the FGGNP cloning transformation, 

Alice and Bob measure their respective qubit in the X basis. Naturally, Eve, who is assumed to listen to their 

public communication gets informed about their choice of basis and decides to measure her qubit and the ancilla 

in the X basis too. Let us assume that Alice's measurement reveals that the state of the A qubit is up (|+)^) (as 

the full state is symmetric under the exchange of 1+)'^ and |— )"^, the treatment would be entirely similar when she 

measures a spin down along X). Then, we obtain by direct computation that the probabilities that Eve's qubit 

is polarised along +X {—X) while the ancilla is polarised along +X {—X), denoted Pem{+x{—x),+x{—x)) are 

distributed as follows: Pem{+x,+x) = ^{v + x)^ ,Pem{-x,-x) = ^{v-x)^, Pem{+x,-x) = ^{y + x)^, and 

Pem(— jf,+x) = ^{y — xY . Now, as it is shown in 0,1131, the extra-information that is present in the ancilla is 

optimally exploited if Eve conditions the result of the measurement on the qubit E on its eaualitv|24j (inequality) 

with the result of the measurement on the ancilla M . We shall now emit the heuristic hypothesis according to which 

it is possible to drop the ancilla and thus to replace the 3 qubit cloning state by a 2 qubit state when this can be 

done without losing information so to say when the statistics of Eve's results is invariant when we condition them on 

their equality (inequality) with the values of the spin of the ancilla. The validity of this hypothesis will be discussed 

in detail in the next section. 

The ancilla can be dropped without losing information whenever -^^^--f = -PgM(-x,--x) ^ u^jjgj. ^j^jg condition 
the probabilities of firing of Eve's detectors are the same, when they are conditioned on their equality (inequality) 
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with the polarisations of the ancilla. These constraints are fulfilled either when 



y x~y 



or when 



(22) 



(23) 



In addition of the normalisation condition, each of these constraints defines a one-parameter class of phase-covariant 
doners, but the optimal doner fulfills only the first equation. Therefore, from now on we shall focus only on the 
family defined by the first equation. We shall elucidate the real meaning of this constraint in the next subsection. 
Taking account of the definition of the Bell states (Eq. QJ), the FGGNP state can be rewritten as follows: 



^Mi3(fo>AB|l)| - yKi)AM'^)% + ^(|i?fo>A,B + |Sf i)As)|0)|}|l)f, (24) 

If H±£ — then — vy. Beside, 2x^+y'^+v'^—l by normalisation so that {v + y)^ ^ + 2vy + y"^ = 

+ 2a;^ + y^ — \. As w and y are real positive parameters, we have that v + y = 1. The normalisation condition can 
also be rewritten as follows: {v — y)^ + Ax"^ = 1 so that we are free to redefine v — y and 2x as follows: v — y = cosa 
and 2x = sina, where a € [0, tt]. Taking account of these reparametrisations, and of the definition of Bell states, we 
can finally express the FGGNP cloning state as follows: 

\^)a%':eSi - ^{\mABE + cosa\mlsE + sina\m\sE)WM + 

^i\\\\)lBE + cos«|001)1bb + ™|010)1bb)|1>m (25) 

This means that 

rni^Z^ = ^^mi%.EWM + i*>S'ii)f.) (26) 

where 1^)^'^'^^^' is obtained by inverting the north and south poles (0 and 1) inside the expression of l^*)^*^ In 
other words, when we trace over the ancilla during the FGGNP cloning process, everything happens as if we realised 
the NG attack with probability 50 % and the same attack, up to a permutation of the north and the south pole, 
otherwise The FGGNP attack is thus equivalent to a symmetrized (relatively to the equatorial plane) version of 
the NG attack. For instance, in the optimal case, the error rate of the NG cloning process is equal to 50 % along the 
south pole and to along the north pole. In average it is thus equal to 25 % during the symmetrized NG process, the 
same as for the optimal FGGNP process, as it must. 



III. ABOUT THE REDUCIBILITY OF 3 QUBIT CLONERS TO 2 QUBIT CLONERS. 

In the previous chapter, we showed that, when Eve does not gain more information when she conditions the results 
of the measurements performed on the clone onto their equality with those obtained from the ancilla, the 3 qubit 
doner can be reduced to a 2 qubit doner. This condition was introduced heuristically. It is interesting to understand 
why it is so, and also to investigate the generality of this condition: for instance it is legitimate to understand whether 
or not it is a necessary condition, or a sufficient one. 

Before doing so, it is worth recalling that in the present approach we are only interested in 3 qubit cloning states 
that fulfill Cerf's ansatz. This means that the cloning state is biorthogonal in the Bell bases, which imposes that the 
Eq. (0J is fulfilled, where am,n is a (normalised) 2x2 matrix and where the Bell states are defined by Eq. (^), relatively 
to a reference basis, say the (Z) basis. The specification of the amplitudes a„j_„ defines the cloning transformation. 

The following definition that was inspired by the equality (|26|) helps us to precise what we mean in general by 
reducibility of 3 qubits doners to 2 qubit doners. 

Main definition: 
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A 3 qubit doner that fulfills Cerf 's ansatz (in the reference {Z) basis) is said to be reducible to a 2 qubit doner in 
the Z basis iff it is possible to find a qubit basis {|0), a positive real number p comprised between and 1 and 
two unitary two-qubit transformations Ube and Vbe such that 

1 

\'^)a':b,E,M ^ E a™,"l^™,")is|5m,„)|,M = %/Pl*''>A,B,i=;|0)A/ + v/r^|*''>A,B,B|i)A/ (27) 
m,n— 

where |*^)A,i3,i5 = Ia<S) Ube\B§,o)ab\0)% and \'i>^)A,B,E = Ia'S) Vbe\B^,q)ab\0)I: 
It is very easy to check that the following corollaries are valid: 

Corollary 1: a 3 qubit doner is reducible to a qubit doner iff it is possible to find a qubit basis {|0), |1)}, and two 
unitary two-qubit transformations U'^^ and V^^ such that 

mTB.E.M - V^i\^''')A,BMO)M + V^\'^'")a.bM~^)m) (28) 

where |*^')a,b,£; = U«)t^Bij|B^o)AB|0)|' and |*^')a,b,£; = V^£;|S|o)as|0)|', where the Z' basis is arbitrary. 
This is a direct consequence of the identity IHI 

Corollary 2: when a 3 qubit doner is reducible to a qubit doner, then the cloning state reduced on the de- 
grees of freedom of the ancilla is a mixture of two 2 qubit cloning states. Indeed, we have that p'^^^~^'^'^'^^^'^ — 

Traceum^^EMiM^^EM = p\'^'^)amA'^'^\am,eH^ - p)\^^)am Moreover, 1^-^^) and |*^) can 

be generated by interactions that do not involve Alice's qubit, and no ancilla M is required, which represents a serious 
simplification of the cloning process. 

We shall now prove the following theorem: 

Main theorem: 

A) Necessary condition: 

When a 3 qubit doner that fulfills Cerf's ansatz (in the reference [Z) basis) is reducible to a 2 qubit doner in the 
Z basis and when the matrix am,n is purely real, then: 
either 

i) «o, 0^*0,1 = o.ifiO'i,! 
or 

ii) ao,oai.o = ao,iai,i 
or 

iii) ao, 001,1 = 00401,0 

B) Sufficient condition: 

i) When ao,oOo,i = oi,oOi,i, then the Eq. H27|) is fulfilled with the qubit basis {|0), |1)} equal to the Z basis. 

ii) When ao.ooi.o = oo, 101,1, then the Eq. (|27|l is fulfilled with the qubit basis {|0), |1)} equal to the X basis. 

iii) When oo,oOi,i = oo.ioi.o, then the Eq. H27|) is fulfilled with the qubit basis {|0), |1)} equal to the Y basis 
Proof of the main theorem: 

A. Proof of the necessary condition. 

Without loss of generality, we can parametrize {|0), |1)} as follows: {|0) — cos||0) + e*'^sin||l), |1) ~ sm||0) — 
e''^cos||f)}. Then, in virtue of Eq. ((T)) and Eq. (O, we have that 

1 

\^) A,B,E,M ~ 5^ am,n\Bm,n)\^B\Bm,n)%^M — 
m,n—0 

^[|0)I((oo,o + oo,i)|00)i^ + (ai,o - oi,i)|ll)|£)|0)f, + 

|0)5((oo,o - oo,i)|01>i^ + (ai,o + Oi,i)|10)i^)|l>f, + 
|l)I((oo.o - oo.i)|10)i^ + (01,0 + oi,i)|01)i^)|0)ff + 
|l)I((ao,o + ao,i)|ll)iB + (01,0 - oi,i)|00)is)|l)ff] = 

^(|0)IC/bb|00)|^ + \lfAUBE\lOfBE)icos^\0)fi + e^sin-\\)l,) + 



^^(|0)lFsij|00)i^ + \\)lVBEmlE){^^n-\Q)M - ^'^cos\\\)l,) (29) 

Unitarity of U imposes that Vbe\^^)%e ^"^^ Vbe\^^)'be ^"^^ mutually orthogonal and normalised. A similar 
constraint holds for V . Now, projecting the eaualitv 1291 onto the basis \i2) am (where ?, j € {0, 1}), we obtain four 
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identities: 



(^)((ao,o + ao,i)|00)i£; + (ai,o - ai,i)|ll>i£) = ^cos^UbeMbe + ^^^^ stn^Ve e\00) b e (30) 



(^)((«o,o - ao,i)m%E + (ai,o + ai,i)|10)li;) = ^e'tsm^UBElOO) be + ^^^^{-)e"^cos^VBEm be (31) 
(^)((ao,o - ao,i)|10)iB + (ai.o + ai.OlOl)!^) = ^cos^C/s£|10)s£ + ^^^szn^^BBllO)^^ (32) 



(^)((ao,o + ao,i)|ll)iB + («i,o - ai.OlOO)!^) = ^e'*szn^C/s£|10)Bi; + ^^^(-)e*"*cos^Fs£|10)s£ (33) 
By elementary algebra, it is easy to check that: 

^e''^UBEm^E^e'^(^os^i{aofi + ao^)m%E + {ai.o-aiA)\nfBE) + s^^^ 

(34) 



^2(1 - p)e'^VBEmlsE = e'^sz7i-((ao,o+ao,i)|00)iB+(ai,o-ai,i)|ll)iij)-cos-((ao,o-ao4)|01)Ii;+(ai,o+ai,i)|10)lB) 

(35) 

V^e'^iJsBllO)!^ = e''^cos^((ao,o-aoa)|10)i£ + (ai,o+aia)|01)lB) + s«n^((ao,o + aoa)|ll)iB + (a^ 

(36) 

x/2(l - p)e'*yB£|10)|B = e"^szn^((ao^o-ao,i)|10)iB+(ai,o+aia)|01)i£)-cos^((ao,o+ao.i)|ll)l£+(ai,o-ai,i)|00)lB) 

(37) 

When Um.n is a purely real matrix, the orthogonality of Ube\00)be and Ube\^0)be imposes that 
e~*'^cos|sm|(ao,o + ao,i)(ai,o ~ ai_i)+e*"^cos|sm|(ao,o — ao,i)(ai,o + 0,1,1) = 0. This equation has two groups 
of solutions: either cos|sm| = 0, or (ao,o + ao,i)(ai,o — = (— )e^*'^(ao,o ~ ao,i)(cii,o + ai,i)- 

When cos|sm| = 0, the basis {|0), |i)} is the Z basis, and, because ||J7b_b|00)b_b|| — ||C/b_e|10)b_e|| by unitarity, we 
get, taking account of the reality of the matrix am,m that (ao,o + ao,i)^ + («i,o — = (ao,o — oo,i)^ + (ai,o + 

so that we must impose that (i) 00,0^0,1 — ai.oai.i- 

When (ao.o + ao,i)(ai,o ~ ai,i) ~ (~)e^*"^(io,o — ao,i)(ai,o + ai,i)j taking account of the reality of the matrix a^.n, 
either (j)=0 and (ii) ao,oii.o — ao.iai,i or (p — ^ and (iii) ao,oai,i = ao,iai,o- It is easy to check that when the conditions 
i, ii, or iii are fulfilled the other constraints imposed by the unitarity of U and V are automatically satisfied. 

B. Proof of the sufficient condition. 

Let us firstly prove the suflicient condition (ii). If ao.oai,o = ao,iai,i: then (ao,o + ao,i)(ai,o — ai,i) — ^(lo.o ^ 
ao,i)(ai,o + fli.i) and we can, without loss of generality, assume that (ao,o + io,i) = ck, (ao,o — 0^0,1) — P, (11.0 + oi.i) = 
—ra, and (ai_o — ai,i) = ''Z? with r, a and /3 real (in the special cases where a and (3 would be equal to 0, we must 
be careful and consider the limit in which r would go to infinity, but it does not invalidate the reasoning). We have 
then, taking account of Eq. Q and Eq. after substitution, that 

\^/A,B,E,M — 

i|0)I[(a|00)|s + r/3|ll)|^)|0)f, + (/3|01)|^ - ra|10)|^)|l)f,] + 
|l)lP|10>ii, - ra\OlfsEmfi + {a\nfBE + rpmsEmM] = 
i|0)i(a|00)is + rf3\U)BE + m)BE - rlpha\lQ)%E)^{\0)fj + 

+ |l>I(a|ll)|s + r/3|00)|s + /3|10)i^ - r aZp/ia|01)i^)-^(|0)f, + |l>f,) 

+ |0)I(a|00)i^ + rp\n)BE - m)BE + r aZp/ia|10)i^)-^(|0>f, - |l>f,) 

+ |l)i(-a|ll)i^ - r/3|00)|s + /3|10)i^ - m|01)|s)-^(|0)f, - |l)f,) (38) 
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Let us consider the transformations U and B defined as follows: 



UBEmBE 


= ^(a|00)|B 


+ rm)BE- 


+pm)BE 


-r«|10)|^) 


Ube\10)be 


= -^(a|ll)|B 


+ rmfBE 


+ /3|10)Ib 


-ra|01)is) 


VbeMbe 


= -^(a|00)|s 


+ rf3\n)BE 


-/3|01)Ib 


+ ra|10)is) 


Vbe\00)be = 




- rPlOOfsE 


+ /3|10)Ib 


-m|01)is) 



(39) 

It is easy to check that U and V are unitary, taking account of the normalisation of \'^)'a'^b^e ai '^^ ^^'■^ ^^'^^ that 
r is real. Substituting Eq. H39|l into Eq. (|38|l ends the proof of the sufficient condition (ii). 

The proof of the sufficient condition (iii) is entirely similar. For proving the sufficient condition (i) it is enough to 
make use of the identities 1171 Then, in virtue of the sufficient condition (ii), we have that when ao^o^o,! = cti.oQi.ij 



WTbUm = ^\^'')amA^)m + ^^|*^)^,B,i^|i)M (40) 



where |0)m = 7f + h)^') = |0)f/ and \1)m = 75(1+)'' - h)"") = |1>m, and where \^'')a,b.e ^ U® 

UBE\B^fl)AB\+)^ = lA®U'BE\Blo)ABm and \^^)a,B,E = lA(i5VBE\Blo)AB\+)^ = U ® V^^ij l^oV^S |0)| with 

U', V, V unitary, so that: 



mTJ.E.M = ^|*^')AB,i.|0)f, + ^^\^'")aM,e\^)1, (41) 



which ends the proof. Note that in all the cases the symmetry of \^)'a^b^e m under permutation of the basis states 
of the X, Y, and Z bases imposes that p—l — p= ^. 

Let us now reconsider the heuristic hypothesis according to which it is possible to drop the ancilla and thus to 
replace the 3 qubit cloning state by a 2 qubit state when the statistics of Eve's results is invariant when we condition 
them on their equality (inequality) with the values of the spin of the ancilla. According to this hypothesis, the ancilla 
can be dropped without losing information whenever — -Pea? (-z,-z) ^ \Yhen the matrix a„i n is purely 

''^'^ ° Pem{+z,-z) Pem[-Z; + z) ^ ■' 

real, this means that cither ao, 0^1,0 = ao.iQ^i.i or ao,oai,i = ao.iii.Oj which corresponds to the conditions ii and iii. 
Obviously the generality of this hypothesis is envalidated by the sufhcient condition i. 

Note that the class of cloning machines that was considered in the section III CI corresponds to the condition ii, 
excepted that the reference basis is then the X basis (or the Y basis in virtue of the covariance). The condition ii 
must be rewritten after permutation of ai^ and ao,i, which is equivalent to the condition i in terms of the Z basis, 
in accordance with the identities 1171 

On the basis of the main theorem, it is easy to prove that the (optimal) universal doner is not reducible to a 2 
qubit doner. Indeed, for such a doner, ao 1 = ai = oi 1 and oq 7^ Q,o 1 so that none of the conditions i ii iii can be 
fulfilled. 



IV. CONCLUSIONS AND COMMENTS. 



In summary, we analyzed the possibility to reduce 3 qubit cloning to 2 qubit cloning. From the point of view of 
practical realisability, it is advantageous to economize one qubit in the cloning process. Therefore it is interesting to 
know precisely when this reduction is possible, and this was the goal of the main theorem presented in the section lTTTI 

It is worth noting that there are two distinct cases of reducibility that enter into the scope of this theorem: when 
the condition ii or iii is fulfilled, it is equivalent for Eve to replace the 3 qubit cloning state by its 2 qubit version, 
because she does not lose any information by doing so, but this is not true when the condition i is fulfilled. 

Beside, the extent of validity of our main theorem is per se limited: it could happen that a 3 qubit cloning machine 
can be reduced to a mixture of more than two 2 qubit cloning machines, and it is not possible, on the basis of our 
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main theorem to determine wheter or not this is the case. It is also hmited to qubits, and can be considered as a first 
step towards a theory of economic quTVit doners. 

Moreover, it could happen that 3 qubit cloning states are well approximated by mixtures of 2 qubit cloning states, 
and our main theorem is silent about this situation. It could also happen that mixtures of 2 qubit doners provide 
a good approximation of a non-reducible doner along certain directions of the Hilbert space only. For instance a 
mixture of 3 phase covariant doners, each of which being covariant along a great circle orthogonal to one of the three 
directions X , F, and Z, exhibits the same fidelity in the X , Y and Z bases. It provides a good candidate for cloning 
the cryptographic key exchanged between Alice and Bob during the 6 states protocol in which each state of encryption 
is chosen at random in one of these bases |22| . It is not as performant as the symmetric universal qubit doner of 
Buzek and Hillery, for which a fidelity of 5/6 « 0,8333% is achieved and constitutes a less dangerous attack 
than the optimal (asymmetric) isotropic doner of threshhold fidelity ~ 0, 8436 described in [2lll2^l23l |. Nevertheless, 
it provides in principle a fidelity equal to 2/3. + -^)+l/3.3/4 « 0, 8190%, and it can be realised, in virtue of the 
results of the second section during an attack that consists of a mixture of six 2 qubit cloning processes, it is thus 
reducible to a 2 qubit attack. Remark that the fidelity of this attack is not the same along all directions on the Bloch 
sphere but is maximal along the three canonical bases. 

Finally, one could object that the main theorem concerns only cloning states that are pure and fulfill Eq. ((SJ, with 
purely real amplitudes am,n but it can be checked that all the interesting doners considered in the litterature are of 
this type. A partial elucidation of why it is so can be found in 
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